4 separate RSAC 2026 keynotes arrived on the identical conclusion with out coordinating. Microsoft's Vasu Jakkal informed attendees that zero belief should lengthen to AI. Cisco's Jeetu Patel referred to as for a shift from entry management to motion management, saying in an unique interview with VentureBeat that brokers behave "extra like youngsters, supremely clever, however with no worry of consequence." CrowdStrike's George Kurtz recognized AI governance as the largest hole in enterprise expertise. Splunk's John Morgan referred to as for an agentic belief and governance mannequin. 4 corporations. 4 phases. One drawback.
Matt Caulfield, VP of Product for Id and Duo at Cisco, put it bluntly in an unique VentureBeat interview at RSAC. "Whereas the idea of zero belief is nice, we have to take it a step additional," Caulfield mentioned. "It's not nearly authenticating as soon as after which letting the agent run wild. It's about constantly verifying and scrutinizing each single motion the agent's attempting to take, as a result of at any second, that agent can go rogue."
Seventy-nine p.c of organizations already use AI brokers, in line with PwC's 2025 AI Agent Survey. Solely 14.4% reported full safety approval for his or her whole agent fleet, per the Gravitee State of AI Agent Safety 2026 report of 919 organizations in February 2026. A CSA survey offered at RSAC discovered that solely 26% have AI governance insurance policies. CSA's Agentic Belief Framework describes the ensuing hole between deployment velocity and safety readiness as a governance emergency.
Cybersecurity leaders and business executives at RSAC agreed on the issue. Then two corporations shipped architectures that reply the query in another way. The hole between their designs reveals the place the actual threat sits.
The monolithic agent drawback that safety groups are inheriting
The default enterprise agent sample is a monolithic container. The mannequin causes, calls instruments, executes generated code, and holds credentials in a single course of. Each part trusts each different part. OAuth tokens, API keys, and git credentials sit in the identical surroundings the place the agent runs code it wrote seconds in the past.
A immediate injection offers the attacker every little thing. Tokens are exfiltrable. Classes are spawnable. The blast radius isn’t the agent. It’s the whole container and each linked service.
The CSA and Aembit survey of 228 IT and safety professionals quantifies how widespread this stays: 43% use shared service accounts for brokers, 52% depend on workload identities relatively than agent-specific credentials, and 68% can not distinguish agent exercise from human exercise of their logs. No single perform claimed possession of AI agent entry. Safety mentioned it was a developer's accountability. Builders mentioned it was a safety accountability. No person owned it.
CrowdStrike CTO Elia Zaitsev, in an unique VentureBeat interview, mentioned the sample ought to look acquainted. "Lots of what securing brokers appear to be can be similar to what it seems prefer to safe extremely privileged customers. They’ve identities, they’ve entry to underlying techniques, they motive, they take motion," Zaitsev mentioned. "There's not often going to be one single answer that’s the silver bullet. It's a protection in depth technique."
CrowdStrike CEO George Kurtz highlighted ClawHavoc (a provide chain marketing campaign focusing on the OpenClaw agentic framework) at RSAC throughout his keynote. Koi Safety named the marketing campaign on February 1, 2026. Antiy CERT confirmed 1,184 malicious expertise tied to 12 writer accounts, in line with a number of impartial analyses of the marketing campaign. Snyk's ToxicSkills analysis discovered that 36.8% of the three,984 ClawHub expertise scanned comprise safety flaws at any severity degree, with 13.4% rated important. Common breakout time has dropped to 29 minutes. Quickest noticed: 27 seconds. (CrowdStrike 2026 World Risk Report)
Anthropic separates the mind from the arms
Anthropic's Managed Brokers, launched April 8 in public beta, break up each agent into three elements that don’t belief one another: a mind (Claude and the harness routing its selections), arms (disposable Linux containers the place code executes), and a session (an append-only occasion log exterior each).
Separating directions from execution is among the oldest patterns in software program. Microservices, serverless features, and message queues.
Credentials by no means enter the sandbox. Anthropic shops OAuth tokens in an exterior vault. When the agent must name an MCP device, it sends a session-bound token to a devoted proxy. The proxy fetches actual credentials from the vault, makes the exterior name, and returns the outcome. The agent by no means sees the precise token. Git tokens get wired into the native distant at sandbox initialization. Push and pull work with out the agent touching the credential. For safety administrators, this implies a compromised sandbox yields nothing an attacker can reuse.
The safety achieve arrived as a facet impact of a efficiency repair. Anthropic decoupled the mind from the arms so inference might begin earlier than the container booted. Median time to first token dropped roughly 60%. The zero-trust design can be the quickest design. That kills the enterprise objection that safety provides latency.
Session sturdiness is the third structural achieve. A container crash within the monolithic sample means whole state loss. In Managed Brokers, the session log persists exterior each mind and arms. If the harness crashes, a brand new one boots, reads the occasion log, and resumes. No state misplaced turns right into a productiveness achieve over time. Managed Brokers embrace built-in session tracing by way of the Claude Console.
Pricing: $0.08 per session-hour of energetic runtime, idle time excluded, plus normal API token prices. Safety administrators can now mannequin agent compromise value per session-hour towards the price of the architectural controls.
Nvidia locks the sandbox down and screens every little thing inside it
Nvidia's NemoClaw, launched March 16 in early preview, takes the alternative method. It doesn’t separate the agent from its execution surroundings. It wraps the whole agent inside 4 stacked safety layers and watches each transfer. Anthropic and Nvidia are the one two distributors to have shipped zero-trust agent architectures publicly as of this writing; others are in growth.
NemoClaw stacks 5 enforcement layers between the agent and the host. Sandboxed execution makes use of Landlock, seccomp, and community namespace isolation on the kernel degree. Default-deny outbound networking forces each exterior connection by way of specific operator approval through YAML-based coverage. Entry runs with minimal privileges. A privateness router directs delicate queries to locally-running Nemotron fashions, slicing token value and information leakage to zero. The layer that issues most to safety groups is intent verification: OpenShell's coverage engine intercepts each agent motion earlier than it touches the host. The trade-off for organizations evaluating NemoClaw is simple. Stronger runtime visibility prices extra operator staffing.
The agent doesn’t know it’s inside NemoClaw. In-policy actions return usually. Out-of-policy actions get a configurable denial.
Observability is the strongest layer. An actual-time Terminal Person Interface logs each motion, each community request, each blocked connection. The audit path is full. The issue is value: operator load scales linearly with agent exercise. Each new endpoint requires handbook approval. Statement high quality is excessive. Autonomy is low. That ratio will get costly quick in manufacturing environments operating dozens of brokers.
Sturdiness is the hole no person's speaking about. Agent state persists as recordsdata contained in the sandbox. If the sandbox fails, the state goes with it. No exterior session restoration mechanism exists. Lengthy-running agent duties carry a sturdiness threat that safety groups want to cost into deployment planning earlier than they hit manufacturing.
The credential proximity hole
Each architectures are an actual step up from the monolithic default. The place they diverge is the query that issues most to safety groups: how shut do credentials sit to the execution surroundings?
Anthropic removes credentials from the blast radius fully. If an attacker compromises the sandbox by way of immediate injection, they get a disposable container with no tokens and no persistent state. Exfiltrating credentials requires a two-hop assault: affect the mind's reasoning, then persuade it to behave by way of a container that holds nothing price stealing. Single-hop exfiltration is structurally eradicated.
NemoClaw constrains the blast radius and screens each motion inside it. 4 safety layers restrict lateral motion. Default-deny networking blocks unauthorized connections. However the agent and generated code share the identical sandbox. Nvidia's privateness router retains inference credentials on the host, exterior the sandbox. However messaging and integration tokens (Telegram, Slack, Discord) are injected into the sandbox as runtime surroundings variables. Inference API keys are proxied by way of the privateness router and never handed into the sandbox immediately. The publicity varies by credential kind. Credentials are policy-gated, not structurally eliminated.
That distinction issues most for oblique immediate injection, the place an adversary embeds directions in content material the agent queries as a part of reputable work. A poisoned internet web page. A manipulated API response. The intent verification layer evaluates what the agent proposes to do, not the content material of information returned by exterior instruments. Injected directions enter the reasoning chain as trusted context. With proximity to execution.
Within the Anthropic structure, oblique injection can affect reasoning however can not attain the credential vault. Within the NemoClaw structure, injected context sits subsequent to each reasoning and execution contained in the shared sandbox. That’s the widest hole between the 2 designs.
NCC Group's David Brauchler, Technical Director and Head of AI/ML Safety, advocates for gated agent architectures constructed on belief segmentation rules the place AI techniques inherit the belief degree of the info they course of. Untrusted enter, restricted capabilities. Each Anthropic and Nvidia transfer on this course. Neither totally arrives.
The zero-trust structure audit for AI brokers
The audit grid covers three vendor patterns throughout six safety dimensions, 5 actions per row. It distills to 5 priorities:
Audit each deployed agent for the monolithic sample. Flag any agent holding OAuth tokens in its execution surroundings. The CSA information exhibits 43% use shared service accounts. These are the primary targets.
Require credential isolation in agent deployment RFPs. Specify whether or not the seller removes credentials structurally or gates them by way of coverage. Each scale back threat. They scale back it by completely different quantities with completely different failure modes.
Check session restoration earlier than manufacturing. Kill a sandbox mid-task. Confirm state survives. If it doesn’t, long-horizon work carries a data-loss threat that compounds with job length.
Employees for the observability mannequin. Anthropic's console tracing integrates with current observability workflows. NemoClaw's TUI requires an operator-in-the-loop. The staffing math is completely different.
Observe oblique immediate injection roadmaps. Neither structure totally resolves this vector. Anthropic limits the blast radius of a profitable injection. NemoClaw catches malicious proposed actions however not malicious returned information. Require vendor roadmap commitments on this particular hole.
Zero belief for AI brokers stopped being a analysis matter the second two architectures shipped. The monolithic default is a legal responsibility. The 65-point hole between deployment velocity and safety approval is the place the following class of breaches will begin.
